# Cypht: a plugin-driven webmail aggregator for IMAP, JMAP and EWS

> Cypht is a PHP webmail client that combines several accounts into one view, speaking IMAP and SMTP, JMAP and Exchange Web Services, and it is built entirely from module sets executed by the framework. It suits people who want a single mailbox over several providers, and its configuration surface is wide enough that a deployment plan matters.

**cypht-org/cypht** — Cypht: Lightweight Open Source webmail aggregator [PHP, JS].  Supports IMAP/SMTP, JMAP and EWS (Exchange Web Services)

- Repository: https://github.com/cypht-org/cypht
- Website: http://cypht.org
- Stars: 1,787 · Forks: 257
- Language: PHP
- License: LGPL-2.1
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/cypht-org-cypht

## A news reader for mail, over several accounts

Cypht describes itself as a lightweight open source webmail aggregator in PHP and JavaScript, and the framing that gets repeated is that it is like a news reader, but for email. It does not replace your existing accounts, it combines them into one. That is the whole product in a sentence, and it is a narrower claim than a full mail client, though the documentation also describes it as a standard email client that lets you browse and manage IMAP folders and send outbound messages over SMTP. The protocol coverage is the widest part of the feature list: IMAP and SMTP, JMAP, and EWS for Exchange Web Services, with the topics also listing POP3, atom, RSS and a news reader. The primary language is PHP, the licence is LGPL-2.1, the project is not archived, and the last push was on 2026-10-17 with releases v2.12.2 on 2026-08-29 and v2.12.1 on 2026-08-14.

## Module sets are the architecture

The unusual thing about Cypht's internals is that the application is built entirely of plugins, described as module sets, which the documentation notes is obviously a cooler sounding name, and these are executed by the framework. The stated reason is that modules provide a flexible way to add new features or customise the program without hacking the code. The repository layout shows this concretely, with a `modules/` directory alongside `lib/`, `config/`, `language/`, `assets/`, `database/`, `third_party/` and a `scripts/` directory. That is a plugin architecture in the full sense, and it cuts both ways. It makes the program extensible without forking, and it makes the code harder to follow because any feature can live in a module that overrides a core path. The `modules/` information page is published separately on cypht.org, which suggests the module set is treated as a public interface rather than an internal detail.

## The environment template is the deployment checklist

Cypht's `.env.example` is long, and reading it is the best way to understand the moving parts. There is a database block with a connection type, driver, port, host, name, user, pass and socket, defaulting to MySQL, plus a TLS block where `DB_SSL_CA` enables an encrypted connection, which is required when the server runs with `require_secure_transport=ON`, and `DB_SSL_VERIFY_SERVER_CERT=false` is the escape for a self-signed certificate. Then there is the mail side: `IMAP_AUTH_NAME`, `IMAP_AUTH_SERVER`, `IMAP_AUTH_PORT` defaulting to 143, `IMAP_AUTH_TLS` and the Sieve configuration, plus `DEFAULT_SMTP_NAME`, `DEFAULT_SMTP_SERVER`, `DEFAULT_SMTP_PORT`, `DEFAULT_SMTP_TLS` and `DEFAULT_SMTP_NO_AUTH`. User data lives on disk, with `USER_CONFIG_TYPE=file`, `USER_SETTINGS_DIR=/var/lib/hm3/users` and `ATTACHMENT_DIR=/var/lib/hm3/attachments`. The presence of `ADMIN_USERS` and `API_LOGIN_KEY` is what makes it a multi-user server rather than a personal script.

## Sessions, auth and caching, all swappable

Three subsystems are each offered in more than one implementation, and the switches are in the template. `SESSION_TYPE=PHP` with `AUTH_TYPE=DB` is the default, and the `AUTH_CLASS` and `SESSION_CLASS` keys let you name a different implementation. Caching has two independent backends, both enabled by default: `ENABLE_REDIS=true` with `REDIS_SERVER`, `REDIS_PORT`, `REDIS_INDEX`, `REDIS_PASS` and a socket path, and `ENABLE_MEMCACHED=true` with `MEMCACHED_SERVER`, `MEMCACHED_PORT` and an auth flag plus user and password. `ALLOW_SESSION_CACHE` is off by default. Long sessions are also configurable, with `ALLOW_LONG_SESSION=false` and `LONG_SESSION_LIFETIME=30`. The pattern across the whole file is the same: an enabling switch, then the connection details, then a toggle for the risky behaviour, which is a reasonable structure for an application that has to run on shared hosting as well as on your own server.

## The security switches are the part to read carefully

The template contains a run of switches that disable security checks, and they mostly ship with the check enabled, at the value false. `DISABLE_IP_CHECK=false` and `DISABLE_ORIGIN_CHECK=false` are the defaults, and setting either to true removes a layer of request validation. `ALLOW_EXTERNAL_IMAGE_SOURCES=false` controls whether remote images may be loaded, which is the classic tracking-pixel vector in a mail client, so the default of false is the right one and should stay. `DISABLE_FINGERPRINT=false` relates to browser fingerprinting, and `DISABLE_EMPTY_SUPERGLOBALS=false` and `DISABLE_OPEN_BASE_DIR=false` and `DISABLE_INI_SETTINGS=false` are the three that matter for a shared host, since they correspond to PHP settings that a restrictive host would want enforced. The two encryption keys, `ENCRYPT_AJAX_REQUESTS` and `ENCRYPT_LOCAL_STORAGE`, are blank in the template, and blank is not a safe default for either. The security details page is published at cypht.org/security, and there is a `SECURITY.md` in the repository root.

## Three ways to install it

The documentation points all Cypht latest and master version installs at cypht.org/install, which is where the supported path lives. For developers there is a Composer package, jason-munro/cypht on Packagist, which reflects the older project naming. For container deployments there is a Docker image at hub.docker.com/r/cypht/cypht, and the Makefile in the repository drives it. The `setup` target is the one that prepares a local instance, and it runs three steps in order:

```bash
composer install
./scripts/setup_database.php
./scripts/setup_system.sh
```

The first installs dependencies, the second creates the tables and a user, and the third creates directories and configs. The target presumes environment variables are set, which is the point of the `.env` file. The Makefile also has a `docker-up` target that starts the development stack in the foreground with `docker compose -f docker-compose.dev.yaml up --build`, and a `docker-push` target that builds for four platforms at once, linux/386, linux/amd64, linux/arm64 and linux/arm/v7, and requires a tag argument. The `docker-compose.dev.yaml` and `docker/` directories in the tree are what those targets use.

## What the aggregation actually gives you

It is worth being precise about the value, because a mail aggregator can sound like more than it is. Cypht does not move mail between servers and does not become your mail store, it reads from the accounts you already have and presents them together, so a message in a Gmail inbox and a message in an IMAP mailbox appear in one list, and you can send from any of them over SMTP. The project also says it is a news reader, and the topics list includes atom, RSS and a news reader, which is the feature that makes it useful for people who read far more feeds than mail. The limit is that it is a client, so the reliability, the storage and the retention all stay with the original providers, and any provider-side change can break the read path for that account alone. JMAP and EWS support is filed as a tracked item in the issue tracker, which suggests the protocol coverage is evolving rather than frozen.

## Conclusion

Adopt Cypht when you want one web interface over several mail accounts across IMAP, JMAP or Exchange, and you are willing to configure the database, session and cache layers up front. Skip it if you need a hosted service, since Cypht is self-hosted software with a Docker image you run yourself. Before deploying, decide the session and auth types, because the template sets SESSION_TYPE=PHP and AUTH_TYPE=DB, and AUTH_CLASS and SESSION_CLASS can name a different implementation, and note that the security switches DISABLE_IP_CHECK, DISABLE_ORIGIN_CHECK, ALLOW_EXTERNAL_IMAGE_SOURCES and DISABLE_FINGERPRINT are all present in the template, so a hardened install is a decision to make rather than a default.

## FAQ

### How do I install Cypht?

The documentation points all latest and master version installs at cypht.org/install. Developers can use Composer with the jason-munro/cypht package on Packagist, and there is a Docker image at hub.docker.com/r/cypht/cypht. The Makefile setup target runs composer install, ./scripts/setup_database.php and ./scripts/setup_system.sh.

### Which mail protocols does Cypht support?

IMAP and SMTP, JMAP and EWS for Exchange Web Services. The topics also list POP3, atom and RSS, and the documentation describes Cypht as a news reader for email as well as a client that manages IMAP folders.

### What are modules in Cypht and why do they matter?

Cypht is built entirely of plugins, called module sets, executed by the framework. They provide a flexible way to add features or customise the program without hacking the code, and module information is published at cypht.org/modules.

### Which session and cache backends can Cypht use?

SESSION_TYPE and AUTH_TYPE select the session and authentication implementations, with AUTH_CLASS and SESSION_CLASS naming a specific one. Caching can use Redis and Memcached, both enabled by default in the environment template, and ALLOW_SESSION_CACHE controls whether sessions are cached.

### What does DISABLE_IP_CHECK and ALLOW_EXTERNAL_IMAGE_SOURCES do in Cypht?

They are environment switches that remove request validation and allow remote images to be loaded. Both ship with a value of false, and the security details are published at cypht.org/security with a SECURITY.md in the repository root.

## Sources

- [cypht-org/cypht on GitHub](https://github.com/cypht-org/cypht)
- [License: LGPL-2.1](https://github.com/cypht-org/cypht/blob/master/LICENSE)
- [Project website](http://cypht.org)
- [README](https://github.com/cypht-org/cypht/blob/master/README.md)
- [Releases](https://github.com/cypht-org/cypht/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/cypht-org-cypht